If nothing looks like it addresses your problem, then use
Bugzilla
to submit a bug report (but see below for reporting security
bugs privately).

You can reach the OpenSSH developers by sending email to one of
the following addresses:

openssh@openssh.com. This
is a private list read only by the OpenSSH developers.Appropriate for: reports of problems with OpenBSD's OpenSSH,
reports of security problems in OpenSSH on any platform.Not appropriate for: How-to queries, reports of problems on
platforms other than OpenBSD or with third-party patches, general
discussion.

openssh-unix-dev@mindrot.org
This is a public list that requires subscription before posting.
Appropriate for: bug reports, how-to questions and discussion
of OpenSSH on any platform (including OpenBSD).Not appropriate for: reports of security problems,
bug reports for binaries not supplied by the OpenSSH team (unless they
can be reproduced with the vanilla OpenSSH distribution).

Current version problem reports

Test the problem at least twice, with source updated a few days apart.

Do not report source tree compilation problems, unless they persist.
They are almost always your mistake or they are being worked on
as you encounter them.

Remember that the AnonCVS
mirrors are updated behind the actual working source tree.

Sending in bug reports

Try to pin-point the exact problem. Never give vague instructions,
or detail vague problems like "it crashes."
Talk to others on IRC or use some
other forum such as the
mailing list archives
to confirm that it is new, repeatable, etc., and make sure
it is not a local problem.

For an excellent overview of the art of reporting bugs, see Simon
Tatham's
How to Report Bugs Effectively. Remember, the better the
information in your report, the better the chance that your problem
will be resolved.

New features are accepted, especially with code that implements
your suggested new feature.
If someone else writes code for your new feature, the chances are that
it will be misunderstood and created so that you will not recognize it.

Types of bug reports in order of desirability:

Repeatable problems with source fixes are the best.

Repeatable problems that are not specific to your hardware/software
layout.